Table Of Contents

Symbols - A - B - C - D - E - F - G - H - I - K - L - M - N - O - P - R - S - T - U - W - X - Z

Index

Symbols

# (number sign) 10-4

* (wildcard) 2-6, 4-5, 10-3

A

AAA

accounting 3-13

authentication 3-6

authorization 3-11

configuring 3-4

aaa accounting command 3-13

aaa authentication command 3-6

aaa authorization command 3-11

accounting, configuring 3-13

action command 6-19

action flow 10-6

activation

activation-extent command 8-11, 8-13

activation-interface command 8-13

activation sensitivity 8-13

add-service command 6-9

admin privilege level 2-2, 3-7

always-accept 6-21

always-ignore 6-21

anomaly

detected 10-2

flow 10-3

anomaly detection engine memory usage 11-26, 11-28

arp command 11-29

attack report

copying 10-7

detected anomalies 10-2

exporting 10-7, 12-6

exporting automatically 10-7

history 11-25

layout 10-1

notify 10-4

statistics 10-2

timing 10-1

viewing 10-4

attack type

detected attack 10-5

authentication, configuring 3-6

authorization

disabling zone command completion 3-12, 4-7

authorization, configuring 3-8, 3-9

auth packet types 6-11

automatic detect mode 1-5

automatic protection mode 8-3

automatic protect mode 8-3, 9-1

B

banner

configuring login 3-32

Berkeley Packet filter 5-7

BGP 8-9

burn flash 12-10

bypass filter

command 5-10

configuring 5-10

definition 1-4, 5-1

deleting 5-12

displaying 5-11

C

capture, packets 11-14

CFE 12-10

clear counters command 2-10, 11-4

clear log command 11-11

CLI

changing prompt 3-28

command shortcuts 2-6

error messages 2-5

getting help 2-5

issuing commands 2-3

TAB completion 2-6

using 2-1

command completion 3-12

command line interface

See CLI 2-1

command shortcuts 2-6

config privilege level 2-2, 3-7

configuration

file

copying 12-3

exporting 12-3

importing 12-4

viewing 11-2

importing 12-4

saving router 8-11, 8-14

configuration, accessing command mode 3-12

configuration mode 2-2

configure command 2-7

constructing policies 7-4

copy command

packet-dump 11-17

copy commands

ftp running-config 12-4

log 11-8, 11-10

new-version 12-9

reports 10-7

running-config 4-15, 12-3

zone log 11-10

copy-from-this 4-6

copy guard-running-config command 4-15, 4-17

copy login-banner command 3-33

copy-policies command 7-17

copy wbm-logo command 3-34

counters

clearing 2-10, 11-4

history 11-4

counters, viewing 11-4

cpu utilization 11-27

D

date command 3-24

DDoS

nonspoofed attacks 1-3

overview 1-2

spoofed attacks 1-2

zombies 1-3

deactivate command 8-5

deactivating commands

commands, deactivating 2-4

default-gateway command 2-10

description command 4-7

detect

automatic mode 1-5

interactive mode 1-5

detect command 8-5

detected

anomalies 10-2

flow 10-6

detected attack 10-5

DETECTOR_DEFAULT 4-3

DETECTOR_WORM 4-3

Detector configuration

resetting 12-13

diff command 7-14, 7-15

disable command 6-7

disabling

automatic export 12-7

disk usage 11-25

DNS

detected anomalies 10-2

TCP policy templates 6-3

tcp protocol flow 10-5

dst-ip-by-ip activation form 8-4

dst-ip-by-ip activation method 8-7

dst-ip-by-name activation method 8-4

dst traffic characteristics 6-12

Dynamic filter

command 8-15

displaying 8-11

timeout 8-9

dynamic filter

1000 and more 5-14

command 5-15, 5-16

definition 1-4

deleting 5-16

displaying 5-13

displaying events 11-7, 11-9

overview 5-2, 5-13

preventing production of 5-16

sorting 5-13

worm 6-23

dynamic filters 9-2

dynamic privilege level 2-2, 3-7

E

enable

command 3-10, 6-7

password command 3-9

enabling services 3-2

entire-zone activation method 8-4

even log

deactivating 11-8

event log

activating 11-8

event monitor command 11-8

export

disabling automatic 12-7

export command 12-6

packet-dump 11-16, 11-17

reports 10-7

exporting

configuration file 12-3

log file 11-10

reports automatically 10-7

exporting GUARD configuration 4-15, 4-17

export sync-config command 4-17

extracting signatures 11-20

F

facility 11-8

file server

configuring 12-2

file-server

command 4-16, 12-2

configuring 12-2

deleting 12-2

displaying 12-3, 12-8

displaying sync-config 4-17, 12-7

file server, displaying sync-config 12-8

filters

bypass 1-4, 5-10

dynamic 1-4, 5-2, 5-13

flex-content 1-4, 5-2

overview 5-1

fixed-threshold 6-16

flash-burn command 12-10

flex-content filter

configuring 5-3

definition 1-4, 5-1

displaying 5-8

filtering criteria 5-2

renumbering 5-3

fragments 10-5

detected anomalies 10-2

policy template 6-3

G

generating signatures 11-20

global mode 2-2

global traffic characteristics 6-12

Guard

configuration mode 2-3

exporting configuration 12-6

GUARD_DEFAULT 4-3

GUARD_LINK 4-3, 4-4

GUARD_TCP_NO_PROXY 4-4

GUARD_ zone template

policy templates included with zone templates 6-4

guard-conf command 4-10

GUARD configuration, exporting 4-15, 4-17

GUARD configuration, importing 4-15

Guard-protection activation methods 8-4, 8-11

H

histogram command 6-23

history command 11-25

host, logging 11-9

host keys

deleting 3-20, 3-21

hostname

changing 3-28

command 3-28

HTTP

detected anomalies 10-2

policy template 6-3

hybrid 10-5

I

idle session, configuring timeout 3-35

idle session, displaying timeout 3-35

importing

configuration 12-4

importing GUARD configuration 4-15

in-band

configuring interface 2-8

in packet types 6-11

install new-version command 12-10

interactive

operation mode 9-4

policy status 6-21

interactive detect mode 1-5

interactive protection mode 8-3

interactive protect mode 8-3, 9-1

interactive-status command 6-21

interface

activating 2-8, 2-9

clearing counters 2-10

command 2-8

configuration mode 2-2

configuring 2-8

configuring IP address 2-9

out-of-band 2-8

ip address

modifying, zone 4-8

IP address command

excluding 4-8

ip address command

deleting 4-9

interface 2-9

zone 4-8

ip route command 2-10

IP scan 10-5

detected anomalies 10-2

policy template 6-3

IP summarization 11-13, 11-14

IP threshold configuration 6-18

K

key command

add 3-21, 3-25

generate 3-22, 3-27

remove 3-26

key publish command 3-22

L

learning

command 7-6, 7-8

constructing policies 7-4

overview 7-2

policy-construction command 7-5

synchronizing results 7-4

terminating process 7-6, 7-8

threshold-tuning command 7-7

tuning thresholds 7-7

learning accept command 7-5, 7-7

learning parameters, displaying 7-9

learning-params

deactivating periodic action 7-8

deactivating periodic-action command 7-5

periodic-action command 4-12, 7-5, 7-8, 7-9

threshold-multiplier command 6-16

threshold-selection command 7-7, 7-10

threshold-tuned command 4-8, 7-11

learning-params command 4-12, 4-17

learning-params fixed-threshold command 6-16

LINK templates 7-4

log file

clearing 11-11

exporting 11-8, 11-10

history 11-25

viewing 11-10

logging, viewing configuration 11-9

logging command 11-8

logging parameters, configuring 11-6

login banner

configuring 3-32

deleting 3-34

importing 3-33

login-banner command 3-32

logo, adding WBM 3-34

logo, deleting WBM 3-35

M

management

MDM 2-13

overview 2-11

SSH 2-13

WBM 2-11

max-services command 6-6

MDM

activating 2-13

memory consumption 11-26

memory usage, anomaly detection engine 11-26, 11-28

min-threshold command 6-6

monitoring

network traffic 11-16, 11-17

MP

upgrading 12-9

mtu command 2-9

N

netstat command 11-31

network server

configuring 12-2

deleting 12-2

displaying 12-3, 12-8

displaying sync-config 4-17, 12-7

network server, displaying sync-config 12-8

new version

installing 12-10

upgrading 12-9

no learning command 7-6, 7-8

non_estb_conns packet type 6-11

nonspoofed attacks 1-3

no proxy policy templates 6-4

notify 10-4

notify policy action 6-20

ns policy templates 6-4

NTP 3-24

enable service 3-25

permit 3-25

server 3-25

O

other protocols

detected anomalies 10-2

policy template 6-3

out_pkts packet types 6-11

out-of-band

configuring interface 2-8

out-of-band interface 2-8

P

packet-dump

auto-capture command 11-13

automatic

activating 11-13

deactivating 11-14

displaying settings 11-14

exporting 11-16, 11-17, 12-6

signatures 11-21

packet-dump command 11-14

packets, capturing 11-14

password

changing 3-7

enabling 3-9

encrypted 3-7

resetting 12-11

password, recovering 12-11

pending 9-2

pending dynamic filters 9-2

displaying 9-3, 9-6

periodic action

accepting policies automatically 7-5, 7-8

deactivating 7-5, 7-8

permit

command 2-12, 2-13, 3-3

permit ssh command 3-21

ping command 11-34

pkts packet type 6-11

policy

action 6-13, 6-19, 6-20

activating 6-14

adding services 6-9

backing up current 6-27, 7-18

command 6-13

configuration mode 2-3

constructing 1-4, 7-2, 7-4

copying parameters 7-17

copy-policies 7-17

deleting services 6-10

disabling 6-14

displaying 8-11

inactivating 6-14

learning-params, fixed-threshold command 6-16

marking as tuned 4-8, 7-11

marking threshold as fixed 6-16

multiplying thresholds 6-17

navigating path 6-13

packet types 6-11

show statistics 6-25

state 6-14

threshold 6-13, 6-15

threshold-list command 6-18

timeout 6-13, 6-19

timeout, configuring 8-11

traffic characteristics 6-12

tuning thresholds 1-4, 7-2, 7-7

using wildcards 6-13, 6-24, 6-26

viewing statistics 7-9

policy set-timeout command 6-19, 8-11

policy template

command 6-4, 6-5, 6-7

configuration command level 6-5

configuration mode 2-3

displaying list 6-4

Guard policy templates for synchronization 6-4

max-services 6-6

min-threshold 6-6

overview 6-2

parameters 6-5

state 6-6

worm_tcp 6-5

policy-template add-service command 6-9

policy-template remove service command 6-10

policy-type activation method 8-4

port scan 10-5

detected anomalies 10-2

policy template 6-3

poweroff command 12-8

privilege levels 2-2

assigning passwords 3-9

moving between 3-10

protect

activation methods 8-4, 8-11

automatic mode 8-3, 9-1

deactivating 8-5

interactive mode 8-3, 9-1

protect command 8-5

protection-end-timer 8-7, 8-15

protection-end-timer command 8-13

protect-ip-state command 8-4, 8-11

protect learning command 7-7

protect-packet command 8-13

protocol traffic characteristics 6-12

proxy

no proxy policy templates 6-4

public-key

displaying 3-27

R

rates

history 11-3

rates, viewing 11-3

reactivate-zones 12-8

reboot command 12-8

rebooting

parameters 12-8

recommendations 9-2

accepting 9-7

activating 9-4, 9-6

change decision 6-21

command 9-6

deactivating 9-3, 9-8

dynamic filters 9-2

ignoring 9-7

overview 9-2

viewing 9-4

viewing pending-filters 9-3, 9-6

redistribute detector command 8-11

reload command 12-8

remote-activate policy action 6-20

remote Guard

activating 5-15

commands

activation-extent 8-11, 8-13

activation-interface 8-13

protection-end-timer 8-13

protect-packet 8-13

terminating protection 8-7, 8-15

remote-guard command 8-7, 8-8

remote Guard list

displaying 8-8

remote Guards

activating 8-5

BGP, activating 8-9

default list 8-7

list 8-8

list activation order 8-8

remove service command 6-10

renumbering flex-content filters 5-3

replied IP summarization 11-13, 11-14

report

See attack report 10-1

reports

details 10-4

exporting 12-6

reqs packet type 6-11

router

command 8-10, 8-13

configuration mode 8-10, 8-13

configuring adjacent 8-12

enabling service 8-10

router configuration mode 2-3

routes, redistributing 8-11

routing table

manipulation 2-10

viewing 2-11

running-config

copy 4-15, 12-3, 12-4

show 11-2

S

saving configuration, router 8-11, 8-14

scanners traffic characteristics 6-12

service

adding 6-9

command 2-11, 2-13, 3-2

copy 7-17

deleting 6-10

MDM 2-13

permissions 3-3

snmp-trap 3-28

wbm 2-11

services

enabling 3-2

session, configuring timeout 3-35

session, displaying idle timeout 3-35

session timeout, disabling 3-35

session-timeout command 3-35

set-action 6-20

show commands

counters 11-4

cpu 11-27

diagnostic-info 11-24

disk-usage 11-25

dynamic-filters 5-13, 5-16

file-servers 12-3, 12-8

flex-content-filter 5-8

host-keys 3-21, 3-23

learning parameters 7-9

learning-params 6-16

log 11-10

log export-ip 11-9

logging 11-9

login-banner 3-33

memory 11-26

packet-dump 11-14

packet-dump signatures 11-21

policies 6-24

policies statistics 6-25, 7-9

public-key 3-23, 3-27

rates 11-3

recommendations 9-4, 9-5

recommendations pending-filters 9-3, 9-6

remote-guards 8-8

reports details 10-4

running-config 11-2

show 11-3

sorting dynamic-filters 5-13

sync-config 4-17

sync-config file-servers 4-17, 12-7, 12-8

templates 4-5

zone policies 6-24

show privilege level 2-2, 3-7

show public-key command 3-27

shutdown command 2-9

signature

generating 11-20

snapshot

backing up policies 6-27, 7-18

command 7-13

comparing 7-14

deleting 7-16

displaying 7-16

saving 7-13, 7-14

snapshot command 7-13

snapshots

save periodically 7-9

SNMP

configuring trap generator 3-28

traps description 3-29

snmp commands

community 3-32

trap-dest 3-28

specific IP threshold 6-18

speed command 2-9

spoofed attacks 1-2

src traffic characteristics 6-12

SSH

configuring 2-13

deleting keys 3-26

generating key 3-22, 3-27

host key 3-23

service 2-13

viewing public key 3-23

ssh key, publishing 3-22

state command 6-14

static route

adding 2-10

syn_by_fin packet type 6-11

sync command 4-13, 4-14

synchronization

exporting configuration 12-6

syns packet type 6-11

syslog

configuring export parameters 11-8

configuring server 11-9

message format 11-8

system log

message format 11-8

T

TACACS+

authentication

key generate command 3-19

key publish command 3-22

clearing statistics 3-16

configuring search 3-15

configuring server 3-13

server connection timeout 3-16

server encryption key 3-15

server IP address 3-14

viewing statistics 3-16

tacacs-server commands

clear statistics 3-16

first-hit 3-14

host 3-14, 3-15

key 3-14, 3-15

show statistics 3-16

timeout 3-14, 3-16

TCP

detected anomalies 10-2, 10-5

no proxy policy templates 6-4

policy templates 6-3

templates

LINK 7-4

viewing policies 4-5

zone 4-3

thresh-mult 6-17

threshold

command 6-15

configuring IP threshold 6-18

configuring list 6-18

configuring specific IP 6-18

marking as tuned 4-8, 7-11

multiplying before accepting 6-16

selection 7-13

setting as fixed 6-16

tuning 1-4, 7-2

worm 6-22

threshold-list command 6-18

threshold selection 7-7

threshold tuning

save results periodically 7-9

time, configuring 3-24

timeout command 6-19, 8-11

timeout session, configuring 3-35

timeout session, disabling 3-35

timezone 3-24

traceroute command 11-33

traffic

monitoring 11-16, 11-17

trap 11-8

trap-dest 3-28

tuning policy thresholds 7-7

U

UDP

detected anomalies 10-3

policy templates 6-3

unauth_pkts packet type 6-11

unauthenticated TCP detected anomalies 10-3

upgrading 12-9

MP 12-9

user

detected anomalies 10-3

user filter

command 5-3

username

encrypted password 3-7

username command 3-6

users

adding 3-6

adding new 3-6

assigning privilege levels 3-6

deleting 3-8

privilege levels 2-2, 3-9

system users

admin 2-7

riverhead 2-7

username command 3-6

W

WBM

activating 2-11

WBM logo

adding 3-34

deleting 3-35

worm

dynamic filter 6-23

identifying attack 6-23

overview 6-22

policy 6-11, 6-12

policy templates 6-4, 6-23

thresholds 6-22, 6-23

worm_tcp policy template 6-5

X

XML schema10-7to 10-9, 11-16, 12-7

Z

zombies 1-3

zone

anomaly detection 8-2

clearing counters 11-5

command 4-5, 4-6, 9-4

command completion 3-12, 4-7

comparing 7-15

configuration mode 2-3, 4-7

copying 4-6

creating 4-5

defining IP address 4-8

deleting 4-5

deleting IP address 4-9

duplicating 4-6

excluding IP address 4-8

exporting configuration 4-17

IP address 4-8

learning 7-2

LINK templates 7-4

modifying IP address 4-8

operation mode 4-5

reconfiguring 4-7

synchronize configuration 4-9

synchronizing automatically 4-12

synchronizing offline 4-14

templates 4-3

viewing configuration 4-7

viewing policies 6-24

viewing status 11-3

zone policy

marking as tuned 4-8, 7-11

zone synchronization 7-4